{"record":{"id":"272f8e7b76b140b9","repo":"apache/hadoop","slug":"component-no-aws-credentials","errorCode":null,"errorMessage":"{component}: No AWS credentials","messagePattern":"(.+?): No AWS credentials","errorType":"exception","errorClass":"NoAwsCredentialsException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/MarshalledCredentialBinding.java","lineNumber":165,"sourceCode":"   *\n   * This code would seem to fit into (@link MarshalledCredentials}, and\n   * while it would from a code-hygiene perspective, to keep all AWS\n   * SDK references out of that class, the logic is implemented here instead,\n   * @param marshalled marshalled credentials\n   * @param typeRequired type of credentials required\n   * @param component component name for exception messages.\n   * @return a new set of credentials\n   * @throws NoAuthWithAWSException validation failure\n   * @throws NoAwsCredentialsException the credentials are actually empty.\n   */\n  public static AwsCredentials toAWSCredentials(\n      final MarshalledCredentials marshalled,\n      final MarshalledCredentials.CredentialTypeRequired typeRequired,\n      final String component)\n      throws NoAuthWithAWSException, NoAwsCredentialsException {\n\n    if (marshalled.isEmpty()) {\n      throw new NoAwsCredentialsException(component, NO_AWS_CREDENTIALS);\n    }\n    if (!marshalled.isValid(typeRequired)) {\n      throw new NoAuthWithAWSException(component + \":\" +\n          marshalled.buildInvalidCredentialsError(typeRequired));\n    }\n    final String accessKey = marshalled.getAccessKey();\n    final String secretKey = marshalled.getSecretKey();\n    if (marshalled.hasSessionToken()) {\n      // a session token was supplied, so return session credentials\n      return AwsSessionCredentials.create(accessKey, secretKey,\n          marshalled.getSessionToken());\n    } else {\n      // these are full credentials\n      return AwsBasicCredentials.create(accessKey, secretKey);\n    }\n  }\n\n  /**","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/MarshalledCredentialBinding.java#L147-L183","documentation":"NoAwsCredentialsException from MarshalledCredentialBinding.toAWSCredentials: the marshalled credential set is empty (access key and secret key both blank) when binding config/URI/delegation-token credentials into AWS SDK credentials. The component prefix names the caller (e.g. TemporaryAWSCredentialsProvider or a delegation-token binding); it is the generic 'nothing was supplied' signal on marshalling paths.","triggerScenarios":"Binding marshalled credentials where none exist: no fs.s3a.access.key/fs.s3a.secret.key, URI userinfo, environment variables, or credential store entries, while a provider that requires marshalled credentials (session/delegation paths) is in the chain; delegation tokens issued without marshalled secrets.","commonSituations":"Defaulting to the standard provider chain on a node with no credential source at all; delegation-token deployments where the token lacks credential secrets; config templates that strip credential properties in the name of hygiene.","solutions":["Supply credentials in a supported place: fs.s3a.access.key/fs.s3a.secret.key, URI userinfo, environment variables, or a Hadoop credential store","If credentials come from delegation tokens, verify the token was actually fetched and carries marshalled secrets","Otherwise change the chain to providers that can authenticate here (IAM instance profile, assumed role)","Use S3A logs/diagnostics to see which component reported the empty set"],"exampleFix":"<!-- before: chain demands marshalled credentials, none configured -->\n<property><name>fs.s3a.aws.credentials.provider</name>\n  <value>org.apache.hadoop.fs.s3a.TemporaryAWSCredentialsProvider</value></property>\n\n<!-- after: supply the credential triple, or switch to a provider with a real source -->\n<property><name>fs.s3a.access.key</name><value>ASIA...</value></property>\n<property><name>fs.s3a.secret.key</name><value>...</value></property>\n<property><name>fs.s3a.session.key</name><value>...</value></property>","handlingStrategy":"validation","validationCode":"String ak = conf.get(\"fs.s3a.access.key\", \"\");\nString envAk = System.getenv(\"AWS_ACCESS_KEY_ID\");\nboolean iamPossible = System.getenv(\"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\") != null;\nif (ak.isEmpty() && envAk == null && !iamPossible) {\n  throw new IOException(\"No credential source configured for S3A\"\n      + \" (no static keys, no env vars, no IAM metadata source)\");\n}","typeGuard":null,"tryCatchPattern":"catch NoAwsCredentialsException at the first S3 call; treat as an environment/configuration gap - print which component reported it and fix the credential source; do not retry","preventionTips":["Standardize on one credential mechanism per cluster and template it completely","Use Hadoop credential stores rather than scattered properties","Preflight fs.listStatus() on a known path in job bootstrap to fail fast on auth"],"tags":["s3a","hadoop-aws","credentials","authentication","delegation-token"],"backgroundTag":"missing-aws-credentials","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}